Splunk Security Content

Splunk Threat Reasearch Team (STRT)

We help security teams around the globe strengthen operations by providing tactical guidance and insights to detect, investigate and respond against the latest threats.

Windows Privilege Escalation Suspicious Process Elevation

Exploitation for Privilege Escalation, Abuse Elevation Control Mechanism, Access Token Manipulation

Get WMIObject Group Discovery with Script Block Logging

Permission Groups Discovery, Local Groups

Windows WinLogon with Public Network Connection

Bootkit

Splunk Identified SSL TLS Certificates

Network Sniffing

Delete ShadowCopy With PowerShell

Inhibit System Recovery